Information
By default, users can install add-ins in their Microsoft Word, Excel, and PowerPoint applications, allowing data access within the application.
Do not allow users to install add-ins in Word, Excel, or PowerPoint.
Rationale:
Attackers commonly use vulnerable and custom-built add-ins to access data in user applications.
While allowing users to install add-ins by themselves does allow them to easily acquire useful add-ins that integrate with Microsoft applications, it can represent a risk if not used and monitored carefully.
Disable future user's ability to install add-ins in Microsoft Word, Excel, or PowerPoint helps reduce your threat-surface and mitigate this risk.
Impact:
Implementation of this change will impact both end users and administrators. End users will not be able to install add-ins that they may want to install.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To prohibit users installing Word, Excel, and PowerPoint add-ins, use the Microsoft 365 Admin Center:
Select Settings from the navigation pane.
Select Org Settings from the navigation pane.
Under Services select User Owned apps and services.
De-Select Let users access the Office Store and Let users install trial apps and services.
Default Value:
Let users access the Office Store is Checked
Let users install trial apps and services is Checked